OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access control improperly validates only a single realm obtained via realms.stream().findFirst() on a HashSet, rather than validating all realms associated with the request. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with approximately 50% probability per request (retryable), persist cross-tenant links. This can lead to disclosure of victim asset names through GET requests on the attacker's own alarm. The vulnerability is addressed and fixed in version 1.27.0.

An authenticated attacker can exploit this vulnerability to create cross-tenant alarm-asset links, potentially disclosing asset names from other tenants (realms). This leads to unauthorized information disclosure (confidentiality impact) and integrity impact by persisting unauthorized links. There is no impact on availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts.

A fix is available in OpenRemote version 1.27.0. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. No other mitigations are indicated by the vendor advisory.